Anatomy of a Data Breach: How Personnel Records Were Leaked from Washington County Government

An investigation into the leak of sensitive personnel records from Washington County Government is raising serious concerns about privacy and potential misconduct. The analysis, spurred by a resident’s public dissemination of personnel records on social media, has uncovered a complicated series of events involving allegations against Treasurer Matt Breeding, who is currently campaigning for County Commissioner, and the county’s procedures for handling public records. Radio Free Hub City has analyzed claims related to the supposed method of leaking these personnel records from Washington County Government to examine their validity. Unlike the previous data breach from November 2022, and based upon the observed methodology, this data breach appears to most likely be the result of an administrative breach, not a failure of technical controls.

As previously reported, the chain of events began on March 7, 2026, when a local resident, who is not a Washington County Government employee, brought a anonymously received leaked document to the attention of Radio Free Hub City (RFHC). This document was later published on social media without redactions by the resident. The document, originating from County Commissioner letterhead and dated October 27, 2025, lacked a signature page. It advocated for changing the County Treasurer position from elected to appointed and included serious allegations against Treasurer Matt Breeding, who had declared his candidacy for County Commissioner on February 24, 2026. Further investigation revealed that a complete version of this letter had been sent to Delegate Wivell, signed by all five County Commissioners at the time: John Barr, Jeffrey Cline, Randall Wagner, Randal Leatherman, and former County Commissioner Derek Harvey. Also copied on the letter were members of the County Delegation, County Attorney Zach Kieffer, and County Administrator Michelle Gordon.

In response to the public posting of this document, RFHC submitted multiple public records requests on March 7, 2026. These requests aimed to obtain the full letter and any supporting evidence for or against the allegations made. RFHC also contacted Treasurer Breeding for his response to the document. Between March 8 and April 24, 2026, Treasurer Breeding provided RFHC with numerous documents and personal records intended to refute the claims made in the letter to Delegate Wivell.

On April 24, 2026, 48 days after RFHC’s request was initiated and 18 days beyond the statutory response deadline in Maryland, Washington County Government released a redacted version of the letter to Delegate Wivell. The county stated that redactions were necessary because the information constituted personnel records. The county also clarified that the unredacted version had been shared with Delegate Wivell due to his role as an “elected or appointed official who supervises the work of the individual.” Later the same day, Washington County Government denied RFHC’s request for records that could potentially corroborate or disprove the remaining allegations, classifying them as personnel records.

RFHC has obtained a copy of the leaked, unredacted letter. However, out of respect for privacy concerns, we will not be publishing it, as it contains information the county has classified as personnel records. In addition to our previous reporting on the allegations, we have conducted a metadata analysis of the leaked document. According to the citizen who published the leaked document, who is referred to as Citizen 1 in the analysis, he received an anonymously emailed copy of the letter (missing its signature page) from what appeared to be a Staples print/scan/copy machine.

The metadata analysis, conducted on May 1, 2026, compared the leaked PDF file with other documents, including the redacted document provided by Washington County and a test baseline document scanned and emailed at the Staples in Hagerstown, Maryland.

The leaked document’s metadata provided by Citizen 1 indicated it was created on March 7, 2026, and identified its creator and producer as “Xerox AltaLink C8045,” a model commonly found at self-service kiosks in the Staples store in Hagerstown, Maryland and a match for our test document.

This aligns with Citizen 1’s account of receiving the document via email from a Staples machine. In contrast, a redacted version of the letter provided by Washington County on April 24, 2026, showed metadata indicating it was produced by a “KONICA MINOLTA bizhub C451i,” a different type of multifunction device likely being used by Washington County Government.

Our analysis has concluded that the leaked document was likely printed or copied from a Washington County Government printer on an unknown date, potentially removed from the County Administration Building, and then scanned by a Xerox AltaLink C8045 at a Staples location on March 7, 2026. While definitive ties to the Staples printers cannot be established, such as a match on serial number, the match of printer make and model is likely enough to warrant further investigation.

Radio Free Hub City has pending public records requests seeking information on scanned and emailed documents by any Xerox AltaLink C8045 under Washington County Government control on that date, as well as county payment card records or expense reimbursements for March 7, 2026, at Staples for services involving county employees known to have access to the letter. However, we do not anticipate any responsive records based on these findings.

A county employee or official willfully and knowingly leaking personnel records is a serious matter, potentially resulting in civil or criminal penalties. Based upon the methodology observed in this analysis, the most likely scenario for this data breach is that a current or former Washington County employee or elected official printed or copied the letter while inside a Washington County building, transported it to Staples, and used a Staples self-service printer/scanner to email it to Citizen 1. It is also possible that the letter could have been printed by a member of Washington County Delegation or a staff member with access, but based upon the fact that the Maryland legislative session lasted from January through mid-April, this seems less likely as this would be in the middle of a very busy legislative session.

It is also important to note that even though significant parts of the letter were classified as “personnel records” by Washington County Government, the full unredacted letter was disclosed to the County delegation, despite lack of any legal “supervisor” status existing according to state or county organizational charts.

The other, less likely scenario, is that Washington County suffered another technical data breach due to improper security controls such as what happened in 2022, but that does not appear likely at this time, as the leaked records would likely have the KONICA MINOLTA metadata, instead of Xerox AltaLink.

Washington County Government has previously stated they will not be commenting on this matter, and it is unknown if the County is actively investigating this data breach.

Associated documents for this story are available in our Public Information Archive.

Article by Ken Buckler, based upon information from Washington County Government and previous coverage.

Video Spotlight